What a process audit stirs up, and what it leaves alone
A major process audit is a structured look at how a company does a piece of its work: an internal audit of a core process, a customer's audit of a supplier, or a certification body's visit. The auditing world treats what it sees as confidential by design. ISO's Auditing Practices Group, in its guidance on the ISO 19011 auditing guideline, lists confidentiality among seven principles of auditing, alongside integrity, fair presentation, due professional care, independence, an evidence-based approach and a risk-based approach (a paraphrase of a search excerpt).
For a partner, the audit matters for one reason only. While it ran, the CEO and the process owners walked through how work moves, which systems record it and how many years those records go back. A company's own operating history is what SourceX licenses for AI training and evaluation, and the audit has just put that history in front of the CEO. The verdict is irrelevant to that question: a company with a clean report and a company with ten findings hold exactly the records they held before.
What the audit leaves alone matters as much. No records change hands because of it, and nothing the auditors saw becomes available to anyone outside the audit. When a company goes further and replaces the system that holds those records, the moment is a different one, covered in the quality management upgrade guide.
The audit-to-referral boundary guide
Read this from top to bottom, phase by phase. Only one cell says ask.
| Audit phase | What the company is doing | What a partner may know | The referral move | Off limits |
|---|---|---|---|---|
| Announced and planned | Scoping the audit and preparing the people involved | That an audit is coming, if the CEO mentions it | None yet | Asking what is in scope |
| Fieldwork | Walking auditors through processes and records | Only what the CEO chooses to say | None | Contacting auditors or process owners about the audit |
| Draft findings | Reading and contesting what the auditors found | Nothing | None | Asking about findings, ratings or who is responsible |
| Management response | Agreeing actions and owners | That a response is under way, if told | None | Offering a licensing angle on any finding |
| Closed | The company says the audit is done | That it is done, heard from the company | One question to the CEO, once | Citing anything the audit produced |
| Remediation | Carrying out agreed actions, sometimes for months | Only what the CEO chooses to share | Wait, unless the CEO raises licensing first | Timing an ask to a remediation deadline |
Before closure, the audit is the company's business with its auditors, and anything a partner did there would either distract the CEO or lean on material that was never the partner's. After closure, the audit stops being a subject. It becomes a date on the calendar.
If you performed or supported the audit, your position is narrower still. For internal auditors, the IIA's Global Internal Audit Standards say: "Internal auditors must not disclose confidential information to unauthorized parties unless there is a legal or professional responsibility to do so" (Standard 5.2, quoted from a search excerpt). Outside auditors and consultants answer to their own professional bodies, and some of those bodies restrict referral pay for clients a firm audits. Read your own rules with your own adviser; CPAs can start with the question on referring an audit client. This page gives no legal or professional advice.
Four people near an audit, and the one who decides
| Person | Part in the audit | Part in a referral |
|---|---|---|
| The auditor, internal or external | Gathers evidence and reports findings | None; never asked to pass anything on |
| The process owner who sponsored the audit | Explains the process and owns the response | May later describe systems and years of history, if the CEO asks them to once SourceX is involved; never decides |
| The CEO | Receives the report and accepts the response | The only person who decides whether the company talks to SourceX, and who signs for it |
| You, the partner | None | One question to the CEO after closure, your interest disclosed, an introduction only on the CEO's yes |
Check that the CEO is still the CEO. Audits sometimes come shortly before leadership changes. Once a company has been acquired, the acquirer's CEO decides for it; before the deal closes, the target's CEO still does.
The timing check: would the question stand without the audit?
Run five checks before any outreach, and stop at the first no.
- Has the company itself said the audit is closed? The word comes from the CEO or the company's own statement, never from an auditor, a supplier or industry talk.
- Is the remediation load light enough? If the CEO is halfway through a heavy action plan, wait for a natural pause instead of adding a topic.
- Is anything personal riding on the result? A dispute, a disciplinary process, a lost customer or a contested certificate. If so, hold until it is settled.
- Who decides today, and who explained the processes? Write down both names. The process owner may help later, at the CEO's request; the CEO is the only person you ask.
- Would the question stand if no audit had happened? If you could put the same question to the CEO of any similar company, the audit has only set the timing. If it makes sense only because of something the audit found, do not ask it, because you would be using audit material.
The fifth check carries the weight. It turns the audit into a date and keeps it from becoming a source.
One question to the CEO, and the line you keep
Illustrative wording:
Now that the review is behind you, would you like to hear how SourceX licenses a company's own operating records, such as years of work orders or case histories, for AI training and evaluation? It needs nothing from the audit. I should tell you that SourceX could pay me a reward if your company goes ahead, and that your company would be paid the same amount either way. No reply means no.
Then write one line: the date, the CEO's answer in one word (yes, later or no), the next step and whose step it is. Nothing about the audit goes in the line.
The payout sentence rests on section 4 of the terms, which says the reward "is paid separately by SourceX and is never deducted from the supplier’s agreed compensation." SourceX pays it from its own share; by default it is the greater of $50,000 plus 5% and 15% of what SourceX actually pays the company, with no cap and corporate group. Do not let enthusiasm stretch that: section 4.6 of the sample Channel Partner Agreement bars a partner from telling a company that an estimate, positive interest, a signature or a data upload makes a purchase or a reward certain.
If the CEO says yes, sign the Channel Partner Agreement before submitting, introduce that one company, and let it apply on its own. SourceX then reviews fit and rights; its who-qualifies page counts material belonging to a company's clients, scraped data and introductions made without the decision maker's knowledge among the usual reasons a company is not a fit. Credit goes to the first valid introduction of a company SourceX did not already know, once that company files a verified application within the 90-day window. A company with any earlier lead, account or email history with SourceX is a duplicate, and SourceX settles competing claims in duplicate review. The only data assessment in this story is SourceX's own, carried out with the company after it applies; what a data audit or assessment is explains it. A CEO who wants a private first look can try the company fit checker.
Two audits, two answers (Illustrative)
Illustrative. Generic companies, invented facts.
A 260-person third-party logistics provider. A major customer's audit of its warehouse processes ran for six weeks. The partner, the company's insurance broker, heard about it from the CEO in passing and asked nothing. Two months later the CEO mentioned at a client event that the audit had closed. The broker ran the five checks: closure heard from the CEO, a light action plan, nothing personal riding on it, the same CEO, and a question that would make sense for any logistics company with twelve years of warehouse records. He asked once. The CEO said to raise it again in January, after peak season. His line reads: 4 November, later, CEO asked to hear again in January, broker's step.
A 140-person claims administrator. An operations consultancy supported the company's internal process audit and saw years of claim workflows during fieldwork. One of its consultants knows the CEO well. The firm ran check 5 and failed it: every reason it could give for the company being a strong candidate came from fieldwork. It asked nothing. A year later the CEO raised AI data licensing herself at a conference. The consultant disclosed the firm's interest, pointed her to SourceX's published pages, checked the firm's own professional rules and left the next step with her.
The second case is the harder one, and the more common mistake. A partner who has seen inside a company is the person most likely to think they know it fits, and the least entitled to act on that knowledge.
Three ways the audit moment misleads
- It looks like a quality signal. A clean report says nothing about whether the records are the company's own, how many years they cover or whether a current program needs them. Fit is decided in SourceX's review.
- It invites false urgency. Remediation deadlines are the company's deadlines, not reasons to hurry a licensing question. Real urgency is a dated event such as a system being switched off, and even then the CEO sets the pace.
- It can prompt record clean-ups. An audit sometimes leads a company to retire old systems or tighten retention. Whether to keep or delete records is the company's decision alone; the partner's part ends at telling the CEO, once, that SourceX licenses operating history. A different trigger, a project to write down how the company works, raises similar timing questions in the documentation project guide.
Next step
Refer a company. No cap on rewards. Default reward on a company's first qualifying transaction: the greater of $50,000 plus 5% and 15% of Actual Supplier Payout, with no cap; further qualifying transactions first agreed within 12 months of the first Closing pay 15%. Eligibility and payment conditions apply, including the USD 100,000 Minimum Transaction, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.
Once the company says its audit is closed and all five checks pass, register as a partner, have who qualifies ready for the CEO, and read the program terms before you send the one question. Other trigger playbooks are in the guides library.